CVE-2018-12015

Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 07 Jun 2018, 13:00
Last modified:05 Aug 2024, 08:24

Vulnerability Summary

Overall Risk (default)
medium
45/100
CVSS Score
7.5 HIGH
v3.0 (nvd)
EPSS Score
23.88% HIGH
24% probability +8.81%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

07 Jun 2018, 13:00
Published
Vulnerability first disclosed
05 Aug 2024, 08:24
Last Modified
Vulnerability information updated

Description

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.

CVSS Metrics

  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  • v2.0•MEDIUM•Score: 6.4AV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS Trends

Current EPSS score: 23.88%• Percentile: 96%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • apple•mac_os_x

    < 10.14.4

  • canonical•ubuntu_linux

    12.04 | 14.04 | 16.04 | 17.10 | 18.04

  • debian•debian_linux

    8.0 | 9.0

  • netapp•data_ontap_edge

    na

  • netapp•oncommand_workflow_automation

    na

  • netapp•snap_creator_framework

    na

  • netapp•snapdrive

    na

  • perl•perl

    ≤ 5.26.2

References (12)